Last updated: July 16, 2026
This Privacy Policy explains how CVLens processes personal data. CVLens is a business-to-business service for resume parsing. It applies to visitors of this website and to business customers using the service.
Controller and Contact
The controller for this website and for CVLens account, service, and billing data is:
Amyla.net
Noël Sabosch, sole proprietor
Stadtweg 87
24837 Schleswig
Germany
Email: info@amyla.net
VAT identification number: DE278802588
Roles for CV Data
When a business customer uploads CVs or other personal data about candidates, the customer is generally the controller for that data. The customer is responsible for a lawful basis, transparency obligations, and any required notices or consents.
Where CVLens processes that data solely on the customer's documented instructions, CVLens acts as a processor. The processing relationship must be governed by an appropriate data processing agreement before candidate data is submitted.
Data We Process
Depending on how you use CVLens, we process the following categories of personal data:
- account and workspace data, including name, business email address, authentication data, workspace membership, and API key metadata;
- billing and contract data, including Stripe customer, subscription, invoice, payment-status, and usage information;
- technical and security data, including IP address, browser or device information, request and security logs, and session data;
- support correspondence; and
- CV parsing data submitted by business customers, including uploaded CV files, extracted text, structured parse results, optional analysis results, filenames, format metadata, warnings, and processing status.
Purposes and Legal Bases
We process personal data to provide, secure, and improve CVLens:
- to create and administer accounts, workspaces, API access, and the requested parsing service (Article 6(1)(b) GDPR);
- to collect payments, issue invoices, maintain tax and accounting records, and meet other legal obligations (Article 6(1)(b) and (c) GDPR);
- to prevent abuse, protect the service, investigate security incidents, and maintain reliable operation (Article 6(1)(f) GDPR); and
- to respond to support requests and other enquiries (Article 6(1)(b) or (f) GDPR, as applicable).
For CV and candidate data processed on a business customer's instructions, the customer's documented instructions and the applicable data processing agreement govern the processing. The customer remains responsible for the legal basis for that processing.
Recipients and Processors
Access is limited to people who need it to operate or support CVLens and who are subject to confidentiality obligations. We use the following recipients or categories of processors where necessary:
- OpenAI for structured CV parsing and optional analysis;
- Stripe for payment processing, subscriptions, invoices, and usage-based billing; and
- hosting, storage, transactional-email, monitoring, logging, and security providers that are necessary to operate CVLens.
We require processors to handle personal data only for the agreed purpose and under appropriate contractual safeguards.
International Transfers
Some processors may process data outside the European Economic Area, including in the United States. Where a transfer requires a safeguard, we rely on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, together with supplementary measures where required. You may request further information at info@amyla.net.
Retention
CV parser artifacts are encrypted at rest where stored by CVLens and are retained for the configured operational window, currently 7 days. After that window, raw uploaded documents are deleted and parsed payloads are cleared by the scheduled retention process.
We retain account, billing, audit, usage, support, and security records only for as long as necessary for the relevant purpose and for longer periods only where required for accounting, tax, legal, or security reasons.
Cookies and Technical Storage
CVLens uses technically necessary cookies and similar storage, including session and security mechanisms, to provide authentication and secure access to the service. We do not use optional advertising or marketing cookies through CVLens. If optional analytics or marketing technologies are introduced, we will update this policy and obtain consent where required.
Automated Output
CVLens produces automated parse results and optional analysis. CVLens does not itself make employment, credit, or other decisions that produce legal or similarly significant effects for an individual. Business customers must review output and remain responsible for any decision they make using it.
Your Rights
Subject to the conditions in the GDPR, you have the right to request access to, correction of, deletion of, restriction of processing of, or portability of your personal data. You may also object to processing based on legitimate interests. If processing is based on consent, you may withdraw that consent at any time with effect for the future.
To exercise these rights, contact info@amyla.net. If we cannot resolve your concern, you may lodge a complaint with a data protection supervisory authority. Our competent supervisory authority is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.
Providing Data and Policy Updates
Account, payment, and CV data are required when they are necessary to provide the corresponding CVLens function. If you do not provide required data, we may be unable to provide that function.
We may update this Privacy Policy when our processing changes or when legal requirements require it. The current version is available on this page.